GitHub API failed with status code 403

[kosratdev]

I have added the job from the README in a private repo to check conventional commits while creating a PR, but it failed with the following message:

Run opensource-nepal/commitlint@v1
  with:
    fail_on_error: true
    verbose: false
    token: ***
Run actions/setup-python@v5.1.0
  with:
    python-version: 3.8
    check-latest: false
    token: ***
    update-environment: true
    allow-prereleases: false
Installed versions
  Version 3.8 was not found in the local cache
  Version 3.8 is available for downloading
  Download from "https://github.com/actions/python-versions/releases/download/3.8.18-12303122501/python-3.8.18-linux-24.04-x64.tar.gz"
  Extract downloaded archive
  /usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /home/runner/work/_temp/b56b4199-7104-452f-b816-5a1903b188a1 -f /home/runner/work/_temp/4935eec0-c1a2-4666-8375-d583f2a681c0
  Execute installation script
  Check if Python hostedtoolcache folder exist...
  Create Python 3.8.18 folder
  Copy Python binaries to hostedtoolcache folder
  Create additional symlinks (Required for the UsePythonVersion Azure Pipelines task and the setup-python GitHub Action)
  Upgrading pip...
  Looking in links: /tmp/tmpfr01dzg1
  Requirement already satisfied: setuptools in /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages (56.0.0)
  Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages (23.0.1)
  Collecting pip
  Downloading pip-25.0.1-py3-none-any.whl (1.8 MB)
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 33.8 MB/s eta 0:00:00
  Installing collected packages: pip
  Attempting uninstall: pip
  Found existing installation: pip 23.0.1
  Uninstalling pip-23.0.1:
  Successfully uninstalled pip-23.0.1
  Successfully installed pip-25.0.1
  Create complete file
  Successfully set up CPython (3.8.18)
Run python -m pip install --quiet --disable-pip-version-check -e ${GITHUB_ACTION_PATH}
  python -m pip install --quiet --disable-pip-version-check -e ${GITHUB_ACTION_PATH}
  python /home/runner/work/_actions/opensource-nepal/commitlint/v1/github_actions
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    pythonLocation: /opt/hostedtoolcache/Python/3.8.18/x64
    PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.8.18/x64/lib/pkgconfig
    Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.8.18/x64
    Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.8.18/x64
    Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.8.18/x64
    LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.8.18/x64/lib
    INPUT_TOKEN: ***
    INPUT_FAIL_ON_ERROR: true
    INPUT_VERBOSE: false
Error: Github API failed with status code 403
Error: Process completed with exit code 1.

[kosratdev]

Update

I have set the repository to public and rerun the jobs. It works as expected, so the issue appears to be limited to private repositories.

[aj3sh]

Thanks @kosratdev for reporting the issue. Will look into it 🙂

[aj3sh]

Hi @kosratdev, I checked on my private repo but was unable to replicate the issue.

According to the GitHub API docs, a 403 status code can occur if the rate limit is exceeded. However, for GITHUB_TOKEN, the limit is 10,000 requests per hour, which is quite high. Reference: https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28

So, the actual cause of the GitHub issue is still unclear. I should have logged the full response to capture the error message.

Could you please share more details about how you implemented the workflow, such as:

• Are you using a custom token?
• Is your private repository under an organization?
• What does your workflow configuration look like?

Any additional details you can share would be helpful.

[kosratdev]

Here is the GitHub action job

name: PR Checks

on:
  pull_request:
    branches:
      - main

jobs:
  commitlint:
    runs-on: ubuntu-latest
    name: Conventional Commitlint
    steps:
      - name: Conventional Commitlint
        uses: opensource-nepal/commitlint@v1

As I did not pass any tokens, the GitHub action token is used by default, which can't access the PR commits.